Govern neurodata by how it’s used, not where it’s from

Neurodata laws are being drafted to govern how brain data is used, rather than where it originates. This approach was demonstrated in Chile's Supreme Court ruling in August 2023, which found a consumer neurotechnology company in violation of constitutional rights due to its failure to protect a person's brain data. The plaintiff, physician and former senator Guido Girardi, had purchased a wireless EEG headset from Emotiv.

However, the device only provided access to the data if the user purchased a "Pro" license; otherwise, the data remained in the company's cloud.

Girardi, despite not having access to his brain data, won his case due to the court's ruling. The court based its decision on existing rights, such as physical and mental integrity, and privacy, rather than on the newly added neurorights clause in Chile's constitution. The court emphasized that consent to record data for one purpose does not mean consent to use it for another. This ruling implies that neurodata should be governed primarily by how it is used, rather than by the organ it came from.

The implications of this decision are significant for basic research. Data collected in a laboratory setting is typically used for scientific purposes, resulting in lower risks. Therefore, safeguards should be lighter, allowing research data to be shared across borders with fewer restrictions. However, consumer EEG devices and similar technologies are producing brain data at an unprecedented scale, leading to the need for regulatory frameworks that can adapt to these changes.

The importance of neurodata governance has grown due to the decreasing cost of recording brain activity. What once required a clinic or dedicated lab can now be achieved with a consumer headset or wearable device. As a result, brain data is being generated and shared in ways that existing rules did not anticipate. This shift has fueled the perception that neurodata warrants its own category of protection. This intuition is influencing the current legislation being developed.

For instance, some states, such as California and Colorado, have amended their consumer privacy acts to include brain data among sensitive data. Montana has incorporated neurotechnology data into its Genetic Information Privacy Act. These definitions, however, may not be well-suited to the context of scientific research, as they are primarily designed for consumer products.

Additionally, the definitions of neurodata are inconsistent across different states, leading to potential confusion for researchers, legal professionals, and funding bodies.

These inconsistencies and the rapidly evolving nature of neurodata collection pose challenges for institutions, review boards, and legal offices tasked with reviewing and shaping the use of neurodata. The lack of consistency in definitions could result in different interpretations of what constitutes neurodata in various jurisdictions, potentially impacting the movement, sharing, and reuse of data.

The laws drafted to govern neurodata should, therefore, focus on the way data is used rather than where it originates, ensuring a more flexible and adaptable regulatory framework.